A port authority enables Flexible NetFlow on edge routers and wants to confirm the exporter and cache are actually working before trusting the dashboards. Which verification approach best matches that goal?
Select an answer to reveal the explanation.
Short Explanation
NetFlow is like a shipping log—not the cargo itself. After you turn it on, peek at the monitor, the cache, and whether exports are leaving for the collector. If those look alive, the dashboard is not just wishful thinking.
Full Explanation
At the port authority edge, Flexible NetFlow is useful only when the flow monitor is actually applied and the exporter is successfully delivering records to the collector the dashboards read. The sound verification path is therefore operational and specific: confirm the monitor is attached to the intended interfaces, inspect the NetFlow cache for live entries that reflect expected traffic keys, and check export statistics toward the configured destination so you know records are leaving the router—not merely that configuration lines exist in the running config. That sequence proves accounting is working before operations trusts trend charts for capacity or security decisions.
Disabling CEF globally so every packet is process-switched into the cache fails by concept: CEF is the expected forwarding path on modern platforms, and crippling it for NetFlow validation creates an artificial operating mode that can itself break forwarding performance and still does not prove the exporter path to the collector. Replacing Flexible NetFlow with SPAN mirroring to the exporter IP as the only validation method confuses packet capture with flow metering; SPAN can show frames on a wire but does not validate flow-monitor binding, cache aging, or NetFlow export counters. Clearing the RIB and waiting for OSPF to rebuild before flows appear invents a routing dependency that NetFlow does not have—flow cache population follows traffic seen on monitored interfaces, not an OSPF adjacency refresh cycle.
Exam caveat: ENCOR expects you to distinguish verification of Flexible NetFlow (monitor applied, cache, export stats) from unrelated troubleshooting rituals such as disabling CEF, substituting SPAN, or bouncing the routing table. Know that exporters and collectors must agree on destination reachability and that empty caches often mean no monitored traffic or a monitor not applied—not a mandatory OSPF rebuild.
Operational check on the municipal edge: after applying the flow monitor, generate representative traffic (or wait for production flows), then verify cache entries and export counters increment toward the collector IP/port used by the port-authority dashboards before treating those dashboards as authoritative.